Jason Martin, co-founder and co-CEO of Permiso told MSSP Alert, "Today, enterprises are having to cobble together visibility around their AI initiatives and are unable to obtain a clear understanding of who in their organization is using AI, who is building AI, what AI agents are being deployed, and, importantly, what those AI users, builders, and agents are doing."
By extending Permiso’s Identity Visibility and Intelligence Platform (IVIP), Identity Security Posture Management (ISPM), and Identity Threat Detection (ITDR) capabilities to cover AI means that enterprises can easily understand the state of AI use in their organization and gain unified visibility, exposure management, and behavioral threat detection,, Martin emphasized.
Closing the Gaps Around Shadow AI
The bigger problem is what enterprises can’t see - shadow AI and personal account use. Employees connecting AI tools with corporate credentials or pushing sensitive files into personal model accounts may not mean harm, but those actions move data into places the business can’t control. It’s risk hiding in plain sight.Permiso’s runtime detection brings that activity to the surface. By stitching together signals from identity providers, cloud platforms, SaaS apps, and AI endpoints, it helps teams spot when AI services are granted access they shouldn’t have, when data is being shared with external models, or when personal accounts are crossing into corporate systems. It is about finding the invisible risks before they turn into incidents.“The most common blind spots for shadow AI and personal account use arise when employees are authorizing AI services to connect to various enterprise applications (like email, document repositories, and code repositories) with their corporate credentials or when they’re uploading sensitive files directly into model services associated with their own personal accounts,” Martin explained. “Our runtime detection capabilities correlate telemetry across IdPs, cloud, SaaS, and model provider telemetry to reveal when AI delegation is being used in the corporate environment, when sensitive files are being uploaded to foundational models, or when models are being accessed with personal credentials. Rapid detection and surfacing of exposures helps teams respond quickly and contain the risk.”
Scaling AI Oversight Across Thousands of Agents
As enterprises move from isolated AI experiments to large-scale deployments, the number of agents operating across their environments will grow exponentially. Each agent represents an autonomous entity with delegated permissions, capable of interacting with systems and data at machine speed. Managing that sprawl demands more than static policies - it requires continuous profiling, baselining, and behavioral analysis.“The proliferation of AI agents will create an even larger identity attack surface for organizations to manage,” said Martin. “This expansion will increase the risk of compromise and will require that MSSPs and SOCs are able to not only understand the rapidly changing identity surface, but also exposure risks and behavioral risks in near real-time since these entities will be operating at machine speed.”
Equipping MSSPs to Manage AI Risk
As AI use grows, MSSPs need to keep watch over AI users, builders, and agents just like any other identity. Permiso’s platform helps them do that without adding new tools - offering continuous checks, permission tracking, real-time monitoring, and quick response across cloud and SaaS environments.“Leveraging Permiso’s Identity Security Platform, MSSPs can provide their customers with a complete inventory of Human, Non-Human, Vendor, and AI entities, offer continuous posture checks associated with authentication and authorization exposures and permission drift, runtime activity monitoring, threat detection, and rapid incident response,” Martin said. “Specific to AI agents, Permiso’s capabilities close a critical gap—having no authoritative source for agent inventory or configuration, no ability to trace the lineage of agent action back to a human user or owner, and no ability to understand and classify agent behavior.”
